MSCHAPv2, MySQL, Freeradius
Dan Russell
dan at in-house.com.au
Tue Oct 4 07:37:28 CEST 2005
> -----Original Message-----
> From: freeradius-users-bounces at lists.freeradius.org
[mailto:freeradius-
> users-bounces at lists.freeradius.org] On Behalf Of Alan DeKok
> Sent: Tuesday, 4 October 2005 3:17 PM
> To: FreeRadius users mailing list
> Subject: Re: MSCHAPv2, MySQL, Freeradius
>
> "Dan Russell" <dan at in-house.com.au> wrote:
> > > Because you put it into the NT-Password attribute, instead of
the
> > > User-Password attribute.
> >
> > Okay, I've tried that and not found it to work for me.
>
> Sorry, it *does* work. Since you didn't provide any debug logs or
> config examples, I can only suggest that you probably did it wrong.
>
Hey, I'm not having a go at you, I believe it does work, I'm just having
issue getting it working..
Here is the log of someone attempting to log in :
rad_recv: Access-Request packet from host x.x.x.x:32775, id=33,
length=177
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 422
NAS-Port-Type = Ethernet
User-Name = "wolfer"
Calling-Station-Id = "00:50:FC:68:E6:32"
NAS-Port-Id = "ether2"
MS-CHAP-Challenge = 0x700b1e514cb6628c25441cb76ce17109
MS-CHAP2-Response =
0x010051c12db8db344c7c72d03bda36fd556d000000000000000076fb28d715a538d4ae
05b012cd5edb6e86ee71d8f6d6bbc0
NAS-Identifier = "NAS"
NAS-IP-Address = x.x.x.x
Tue Oct 4 15:10:39 2005 : Debug: Processing the authorize section of
radiusd.conf
Tue Oct 4 15:10:39 2005 : Debug: modcall: entering group authorize for
request 5
Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: calling
preprocess (rlm_preprocess) for request 5
Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: returned from
preprocess (rlm_preprocess) for request 5
Tue Oct 4 15:10:39 2005 : Debug: modcall[authorize]: module
"preprocess" returns ok for request 5
Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: calling chap
(rlm_chap) for request 5
Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: returned from
chap (rlm_chap) for request 5
Tue Oct 4 15:10:39 2005 : Debug: modcall[authorize]: module "chap"
returns noop for request 5
Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: calling sql
(rlm_sql) for request 5
Tue Oct 4 15:10:39 2005 : Debug: radius_xlat: 'wolfer'
Tue Oct 4 15:10:39 2005 : Debug: rlm_sql (sql): sql_set_user escaped
user --> 'wolfer'
Tue Oct 4 15:10:39 2005 : Debug: radius_xlat: 'SELECT
id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'wolfer'
ORDER BY id'
Tue Oct 4 15:10:39 2005 : Debug: rlm_sql (sql): Reserving sql socket
id: 4
Tue Oct 4 15:10:39 2005 : Debug: radius_xlat: 'SELECT
radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgrou
pcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE
usergroup.Username = 'wolfer' AND usergroup.GroupName =
radgroupcheck.GroupName ORDER BY radgroupcheck.id'
Tue Oct 4 15:10:39 2005 : Debug: radius_xlat: 'SELECT
id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'wolfer'
ORDER BY id'
Tue Oct 4 15:10:39 2005 : Debug: radius_xlat: 'SELECT
radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrou
preply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE
usergroup.Username = 'wolfer' AND usergroup.GroupName =
radgroupreply.GroupName ORDER BY radgroupreply.id'
Tue Oct 4 15:10:39 2005 : Info: rlm_sql (sql): No matching entry in the
database for request from user [wolfer]
Tue Oct 4 15:10:39 2005 : Debug: rlm_sql (sql): Released sql socket id:
4
Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: returned from
sql (rlm_sql) for request 5
Tue Oct 4 15:10:39 2005 : Debug: modcall[authorize]: module "sql"
returns notfound for request 5
Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: calling mschap
(rlm_mschap) for request 5
Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: Found MS-CHAP
attributes. Setting 'Auth-Type = MS-CHAP'
Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: returned from
mschap (rlm_mschap) for request 5
Tue Oct 4 15:10:39 2005 : Debug: modcall[authorize]: module "mschap"
returns ok for request 5
Tue Oct 4 15:10:39 2005 : Debug: modcall: group authorize returns ok
for request 5
Tue Oct 4 15:10:39 2005 : Debug: rad_check_password: Found Auth-Type
MS-CHAP
Tue Oct 4 15:10:39 2005 : Debug: auth: type "MS-CHAP"
Tue Oct 4 15:10:39 2005 : Debug: Processing the authenticate section
of radiusd.conf
Tue Oct 4 15:10:39 2005 : Debug: modcall: entering group Auth-Type for
request 5
Tue Oct 4 15:10:39 2005 : Debug: modsingle[authenticate]: calling
mschap (rlm_mschap) for request 5
Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: No User-Password
configured. Cannot create LM-Password.
Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: No User-Password
configured. Cannot create NT-Password.
Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: Told to do MS-CHAPv2 for
wolfer with NT-Password
Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: FAILED: No
NT/LM-Password. Cannot perform authentication.
Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: FAILED:
MS-CHAP2-Response is incorrect
Tue Oct 4 15:10:39 2005 : Debug: modsingle[authenticate]: returned
from mschap (rlm_mschap) for request 5
Tue Oct 4 15:10:39 2005 : Debug: modcall[authenticate]: module
"mschap" returns reject for request 5
Tue Oct 4 15:10:39 2005 : Debug: modcall: group Auth-Type returns
reject for request 5
Tue Oct 4 15:10:39 2005 : Debug: auth: Failed to validate the user.
Tue Oct 4 15:10:39 2005 : Auth: Login incorrect: [wolfer/<no
User-Password attribute>] (from client build port 422 cli
00:50:FC:68:E6:32)
Tue Oct 4 15:10:39 2005 : Debug: Delaying request 5 for 1 seconds
Tue Oct 4 15:10:39 2005 : Debug: Finished request 5
Tue Oct 4 15:10:39 2005 : Debug: Going to the next request
Tue Oct 4 15:10:39 2005 : Debug: --- Walking the entire request list
---
Tue Oct 4 15:10:39 2005 : Debug: Waking up in 1 seconds...
Tue Oct 4 15:10:40 2005 : Debug: --- Walking the entire request list
---
Tue Oct 4 15:10:40 2005 : Debug: Waking up in 1 seconds...
rad_recv: Access-Request packet from host x.x.x.x:32775, id=33,
length=177
Sending Access-Reject of id 33 to x.x.x.x:32775
Here is a snippet of the radcheck table :
ID UserName Attribute op Value
25 wolfer SMB-Account-CTRL == 16
27 wolfer NT-Password ==
0x47C8F8E50C470E37AAD3B435B51404EE
Any help?
Thanks for any help in advance,
Daniel Russell
> > It tries to get the 'User-Password' attribute first (which it fails
on,
> > I don't have one), then it tried to get the 'LM-Password' attribute
> > which it also fails on. After dealing with that it tries the same
thing
> > with 'NT-Password'. For some reason it isn't pulling these
attributes
> > out of mysql..
>
> Read the debug log. It will tell you what it *is* getting from
MySQL.
>
> > After looking at the debug output from freeradius, the sql statement
> > that it executes when it receives an authentication request should
> > return the LM-Password and NT-Password.
>
> Does it return those attributes when you run the query by hand?
>
> Alan DeKok.
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
More information about the Freeradius-Users
mailing list